JP7114375B2 - Cyber security system with adaptive machine learning function - Google Patents

Description

TECHNICAL FIELD This disclosure relates to the field of cybersecurity, and more particularly to machine learning in cybersecurity.

Cybersecurity risks in large enterprises are compounded by the proliferation of network-connected devices used in day-to-day business activities. End-user devices, such as employee smart phones, can be targeted by cyber threats or exposed to sensitive user or organizational information as a result of physical theft of the device. Traditional approaches to tracking and preventing such threats do not provide adequate information to efficiently detect, resolve, and understand the impact of device vulnerabilities across large organizations.

Embodiments described herein provide a cybersecurity system with adaptive machine learning capabilities. End-user devices managed by information technology (IT) systems are equipped with local machine learning capabilities. The machine learning function establishes user signatures unique to particular behavioral patterns learned by monitoring user device usage over time. User signatures are machine-learned to define and detect abnormal usage events for user devices, such as usage that suggests the user device has been stolen, used by unauthorized users, or compromised by malware. Used by functions. After detecting such an event, machine learning capabilities trigger a series of automated actions in response to the security threat. The specific actions or sequences performed adapt over time to machine learning capabilities to detect suspicious threats, including queries from rogue actor networks and devices, and attempts to access specific information or resources on user devices. Event data can be effectively mined. Mined data may be used by central or remote management with machine learning capabilities to identify attack patterns and provide user devices with specific instructions or data (e.g., misinformation to provide in response to access requests) to respond to security threats. You can also send it to the server.

One embodiment is a system that includes a server configured to manage multiple user devices over a network, and the user devices including an interface and a processor. The interface is configured to communicate with a server on the network, and the processor monitors user interaction with the user device over time to establish a usage profile and, based on usage profile discrepancies, controls the user device. , determine whether the abnormal use represents a security threat, and instruct the user device to perform one or more automated actions to respond to the security threat. implement machine learning capabilities that

Another embodiment includes a processor configured to detect anomalous use of a user device based on a history of use of the user device, input information of the anomalous use into a machine learning function, and determine cyber threat characteristics. It is a device. The processor is also configured to determine an automated action to be taken by the user device based on the characteristics of the cyberthreat and instruct the user device to take the automated action to respond to the cyberthreat.

Other exemplary embodiments (eg, methods and computer-readable media for the above-described embodiments) are described below. The features, functions and advantages described above may be implemented singly in various embodiments or may be combined in still further embodiments, further details of which can be found in the following description and drawings. can be understood with reference to

Some embodiments of the disclosure will now be described, by way of example only, with reference to the accompanying drawings. On all drawings, the same reference number represents the same element or the same type of element.
1 depicts an enterprise network environment in an exemplary embodiment; 1 is a block diagram of an adaptive security system in an exemplary embodiment; FIG. 1 is a block diagram of user equipment enhanced with an adaptive security system in an exemplary embodiment; FIG. FIG. 4 is a block diagram of a remote server enhanced by an adaptive security system in an exemplary embodiment; FIG. 4 is a block diagram of a management server augmented by an adaptive security system in an exemplary embodiment; 4 is a flowchart illustrating a method of detecting and responding to security threats in an exemplary embodiment; 4 is a flowchart illustrating a method for automatically responding to security threats in an exemplary embodiment; 4 is a flowchart illustrating a method for automatically responding to security threats in an exemplary embodiment; 4 is a flowchart illustrating a method for automatically responding to security threats in an exemplary embodiment; 4 is a flowchart illustrating a method for automatically responding to security threats in an exemplary embodiment; 4 is a flowchart illustrating a method for determining whether an anomaly indicates a security threat in an exemplary embodiment; 4 is a flow chart illustrating a method for deriving a graphical intrusion event sequence in an exemplary embodiment; 4 is a flow chart illustrating a method for updating a security policy in an enterprise network environment in an exemplary embodiment;

These drawings and the following description illustrate certain exemplary embodiments of the disclosure. Accordingly, one skilled in the art may devise various apparatus not expressly described or illustrated herein to embody the principles of the present disclosure, but are intended to be within the scope of the present disclosure. be understood. Moreover, any examples described herein are intended to aid in understanding the principles of the disclosure and should not be construed as limited to the specifically recited examples and conditions. As a result, the present disclosure is not limited to the specific embodiments or examples described below, but by the claims and their equivalents.

FIG. 1 illustrates an enterprise network environment in an exemplary embodiment. A corporate network environment 100 includes a corporate network 102 with a management system 110 that manages computer security for a large organization or enterprise. The corporate network 102 also has edges such as servers, gateways, firewalls, routers, and other network elements that monitor traffic between the corporate network 102 and the external network(s) 124 and report/block suspicious traffic. Device 108 1 , ₂ . . . _N includes an intrusion detection system 106 formed by. The enterprise network 102 includes each user 152 _1,2 . . . _N operated user equipment (UE) 150 _1,2 . . . _N to perform various computational tasks. UE 150 may include, for example, a personal computer, laptop, smart phone, or the like. UE 150 may be operated by an enterprise employee or customer.

As shown in FIG. 1, UE 150 interfaces directly with (eg, operates within) corporate network 102 or indirectly via one or more external networks 124 (eg, external network 124). ). In any event, the UE 150 can access external resources 126 such as websites, databases and servers via an external network 124 such as the Internet. Some of the external resources 126 or malicious actors 128 on the external network 124 may pose security threats to the UE 150 . Security threats may include manual or automated attacks that attempt to access confidential or valuable information belonging to an enterprise via UE 150 .

Many modern security threats contain sophisticated techniques that automatically evolve the threat over time to evade existing detection/response mechanisms. Additionally, sensitive or valuable corporate information is becoming increasingly vulnerable to attacks targeting devices outside the corporate network 102 (eg, mobile devices) for later exploitation within the corporate network 102 . Traditional systems have difficulty detecting attacks that involve the misuse or physical theft of corporate-related devices connected to the network, and security personnel typically It fails to collect information about the source of the attack, which could be used to identify and remediate the identity.

Accordingly, management system 110 , remote server 130 and UE 150 may be enhanced with adaptive security system 170 to improve computer security in enterprise network environment 100 . With respect to UE 150, adaptive security system 170 can detect and respond to security threats based on behavioral profiles specific to a particular device. That is, each UE 150 can operate with different capabilities, under different circumstances, and by different users 152, and the adaptive security system 170 can control automatic security actions according to each UE 150's local usage and settings. With respect to remote server 130, adaptive security system 170 may provide UE 150 with assistance against ongoing security threats. With respect to management system 110, adaptive security system 170 can provide analysis of system-wide security threat patterns to establish attacker profiles and security rules. It will be appreciated that the enterprise network environment 100 is an exemplary environment for discussion and that the features of the adaptive security system 170 described herein may be employed in alternative environments and applications. Examples and details of the operation of adaptive security system 170 with respect to management system 110, remote server 130, and UEs are discussed below.

FIG. 2 is a block diagram of an adaptive security system in an exemplary embodiment; Adaptive security system 170 includes interface component 202 , one or more processors 204 , and memory 206 . Interface component 202 is a hardware component or device ( transceivers, antennas, etc.). Processor 204 represents the internal circuitry, logic, hardware, etc., that provides the functionality of adaptive security system 170 . Memory 206 is a computer-readable storage medium (eg, read-only memory (ROM) or flash memory) for data, instructions, applications, etc., and is accessible by processor 204 . Adaptive security system 170 may include various other components not specifically shown in FIG.

Processor 204 implements a Machine Learning Function (MLF) 210 . MLF 210 may be implemented in any combination of hardware, firmware and/or software operable to implement machine learning techniques. Machine learning generally refers to an automated process capable of analyzing input data, learning from the data, and adapting the output based on that learning. This differs from conventional computer processes in which the instructions or programming are predefined and explicit such that the same steps are repeated given the same input. That is, rather than having pre-defined activities, the MLF 210 is trained to observe patterns in the data and timed actions or steps to be taken without explicit hand-coded programming or user intervention/instruction. can be adaptively adjusted with

FIG. 3 is a block diagram of UE 150 enhanced by adaptive security system 170 in an exemplary embodiment. UE 150 may include a user device such as a laptop or smart phone, an edge device 108 such as a router or network element, or any other device managed by management system 110 of enterprise network 102 . UE 150 includes one or more processors 302 configured to control operation of UE 150 and process computer-executable instructions to implement embodiments of the techniques described herein. Processor 302 interacts with various subsystems of UE 150 including hardware 304 . Hardware 304 includes memory 306 , embedded hardware components 330 , processing input components 335 and network components 340 . In this example, hardware components 330 include a display 331 operable to receive touch screen input, a camera 332 operable to capture images and video, a speaker 333 operable to project audio, and a It includes a microphone 334 operable to capture sound. Processing input components 335 include input/output (I/O) peripherals 336 such as keyboards and external storage devices, one or more processors 337 , and random access memory (RAM) 338 . Exemplary network components 340 include communication components for Bluetooth 341 , Global Positioning Satellite (GPS) 342 , WiFi 343 and radio 344 .

UE 150 is augmented by an adaptive security system 170 that includes MLF 210 coupled to modules 360-365. More specifically, adaptive security system 170 includes activity monitoring module 360 , anomaly detection module 361 , threat response module 362 , initialization module 363 , honeypot module 364 and reporting module 365 . Each of modules 360-365 may be implemented in any combination of hardware, firmware and software, and may interface with or be implemented on MLF 210 to detect and respond to security threats. Machine learning techniques can be implemented to Components of adaptive security system 170 and/or MLF 210 may be part of operating system (OS) 310, i.e., kernel 312 of OS 310 (e.g., protected areas of memory 306 above kernel 312 of OS 310, within separate programs or applications). hardware abstraction layer (HAL) 318, specialized hardware buffers or processors, or any combination thereof). Further, components of adaptive security system 170 and/or MLF 210 may be stored in memory 306 for use by processor 302 or may be temporarily loaded into RAM 338 for use by processor 302. Conceivable.

The OS 310 broadly includes an application layer 305 that can contain native and user-installed applications, a framework layer 307 that can contain services, managers and runtime environments, and system and other user libraries. It includes a library layer 308 that allows A user can interact with OS 310 through an interface 303, such as a graphical user interface (GUI) that presents menus, buttons, and selectable control items for controlling and using applications running on OS 310. . HAL 318 is the layer between OS 310 and the hardware layer responsible for tailoring OS 310 to different processor architectures. OS 310 may include HAL 318 within kernel 312 or in the form of device drivers that provide a consistent interface for applications to interact with hardware peripherals. Alternatively or additionally, HAL 318 can coordinate application programming interfaces (APIs) at various levels of UE 150 to monitor/observe system events, state changes, and the like. Thus, OS 310 and/or HAL 318 can provide various security settings for UE 150 that authorize applications or actions to access hardware or resources of UE 150 .

Modules 360 - 365 can modify the operation of OS 310 and/or HAL 318 to adapt security settings for UE 150 . For example, the activity monitoring module 360 may monitor activity on the UE 150, such as changes in the type of input/output (I/O) requests directed to the memory 130, changes in the frequency with which files in the file system 314 are accessed, modified, renamed, etc. Various internal services and activities of OS 310 that occur in . Activity monitoring module 360 detects changes in communication requests received via system services 316 on the internal data path, and various exchange commands with subsystems of UE 150 that occur via OS 310 and/or HAL 318; Messages or events can be logged. Activity monitoring module 360 may interact with MLF 210 to obtain learned characteristics and determine whether to decrease or increase the number of resources being monitored, or to change the resources being monitored. can. Activity monitoring module 360 may also store recorded information in memory 306 as device usage data 374 .

Anomaly detection module 361 is configured to determine whether a device of UE 150 is exhibiting anomalous behavior. The anomaly detection module 361 can interact with the MLF 210 to obtain security threat characteristics from anomalous usage information such as threat level, type, and classification. Alternatively or additionally, anomaly detection module 361 may generate attacker data 376 that identifies or predicts information about security threats, such as attack identification or actions. Threat response module 362 is configured to select an action plan for a particular type of anomalous behavior or security threat. Initialization module 363 is configured to apply security settings 370 , parameters 371 , or other policies, rules or user settings as parameters for performing operations by MLF 210 . Honeypot module 364 is configured to prevent or impede user requests or actions. Honeypot module 364 may use HAL 318 to implement protected data 373 that generates/provides erroneous data 377 that hides sensitive information and/or diverts malicious data requests to erroneous data sets. can. Reporting module 365 implements machine-to-machine communication or automated message exchange to provide device usage data 374 and/or attacker data 376 to remote server 130, management system 110 or peers for external detection/response to security threats. It can be sent to UE 150 . Further details of the operation of modules 360-365 to detect security threats and implement machine learning techniques tailored to UE 150 to trigger a series of automated actions are provided below.

FIG. 4 is a block diagram of remote server 130 enhanced by adaptive security system 170 in an exemplary embodiment. Remote server 130 includes interface component 402 configured to communicate with UE 150 and/or management system 110 via one or more external networks 124 , one or more controllers 404 , and memory 406 . Controller 404 represents the internal circuitry, logic, hardware, etc., that provides the functionality of remote server 130 . Memory 406 is a computer-readable storage medium for data, instructions, applications, etc. and is accessible by controller 404 . Remote server 130 may include various other components not specifically shown in FIG.

Controller 404 implements adaptive security system 170 including MLF 210 and false information module 414 . Disinformation module 414 may be implemented in any combination of hardware, firmware and software, or may interface with or implement MLF 210 to employ machine learning techniques to detect and/or respond to security threats. can be executed. The controller 404 is also configured to remotely manage security functions of one or more UEs 150 grouped by common corporate characteristics l, such as location, region, network, department, user group, or work site, via the external network 124. implements the device subgroup manager 420 described. Subgroups of UEs 150 may also be based on common types of devices, models, platforms, hardware, security attributes, or common usage. Device subgroup manager 420 may input device behavior information from UEs 150 to MLF 210 to establish abnormal device usage data and other security event data from the population of UEs 150 in pattern database 422 . The pattern database 422 may be used to identify patterns and train the MLF 210 to adapt its control recommendations for the UE 150 to specific types of security threats. For example, disinformation module 414 may use MLF 210 to provide erroneous data 377 to UE 150 according to patterns in pattern database 422 . Additionally, adaptive security system 170 is adapted to perform functions on behalf of management system 110 and/or one UE 150 . For example, a local security manager may authenticate a user of UE 150 and issue commands to revoke privileges, terminate applications, or otherwise disable compromised or stolen functionality on UE 150. can be issued. Thus, at remote server 130, adaptive security system 170 determines the characteristics or patterns it is looking for in the data and/or how it classifies and responds to inputs based on subgroup characteristics of UEs 150. can be changed by

FIG. 5 is a block diagram of management system 110 augmented by adaptive security system 170 in an exemplary embodiment. Management system 110 includes an interface component 502 configured to communicate with UE 150 and/or management system 110 via one or more internal networks, such as enterprise network 102 and/or one or more external networks 124 . Management system 110 also includes a graphical user interface (GUI) 508 configured to display the intrusion event sequence. Management system 110 further includes one or more controllers 504 and memory 506 . Controller 504 represents the internal circuitry, logic, hardware, etc., that provides the functionality of management system 110 . Memory 506 is a computer-readable storage medium for data, instructions, applications, etc., and is accessible by controller 504 . Management system 110 may include various other components not specifically shown in FIG.

Controller 504 implements adaptive security system 170 including MLF 210 and one or more modules 560 - 563 including activity monitoring module 560 , anomaly detection module 561 , threat response module 562 and display module 563 . Each of modules 560-563 may be implemented in any combination of hardware, firmware and software, and may interface with or be implemented on MLF 210 to detect and respond to security threats. Machine learning techniques can be implemented to Controller 504 also implements a global device manager 520 that manages system-wide security policies for devices operating within or interacting with enterprise network 102 , such as edge devices 108 and UEs 150 . Management system 110 may also include or be coupled to a device database 522 that maintains user, device and pattern information for UEs 150, which may be distributed/collected by authorized UEs 150 or remote servers 130. machine learning may be applied to tailor the security of the enterprise network environment 100 to the specific needs of the end user of the UE 150 or the enterprise.

Management system 110 also includes a network traffic manager 530 configured to route anomalous traffic detected at edge device 108 to MLF 210 to establish traffic patterns in traffic database 532 . Abnormal traffic information obtained from edge devices 108 and abnormal device usage information obtained from UEs 150 are aggregated in management system 110 to detect enterprise vulnerabilities and refine global security manager 114 policies. It can be applied to MLF210. Many configurations of management system 110, remote server 130 and UE 150 are possible. For example, management system 110 and/or remote server(s) 130 may independently or coordinate cloud functions or clusters of servers/computers that perform the same or similar set of described functions in a distributed manner. can be implemented using Further, although modules (eg, modules 360-365 of the UE, disinformation module 414 of the remote server, and modules 560-563 of the management system 110) are described as performing various operations, such modules is merely an example, and as described below, the same or similar functions may be performed by more or fewer modules, and on various platforms (e.g., peer UE 150, remote server 130, management system 110, etc.) may be implemented to perform similar functions.

FIG. 6 is a flowchart illustrating a method of detecting and responding to security threats in an exemplary embodiment. Method 600 is described with respect to enterprise network environment 100 of FIG. However, those skilled in the art will recognize that the methods described herein may be performed by other devices or systems not shown. The steps of method 600 may be performed by one or more UEs 150, one or more remote servers 130, management system 110, or some combination thereof. The method steps described herein are not exhaustive and may include other steps not shown. These steps can also be performed in a different order.

First, management system 110 can define a security policy to distribute to remote servers 130 and UEs 150 under its domain. Security personnel of management system 110 or users of UEs 150 can provide custom security policies targeted to specific ones or groups of UEs 150, users, threat types, machine responses, and the like.

At step 602 , a processor (eg, processor 302 of UE 150 , controller 404 of remote server 130 , and/or controller 504 of management system 110 ) implements MLF 210 . That is, the MLF 210 can be used to perform the machine learning techniques of any of the steps/flowcharts described herein. Although the flowchart steps herein generally refer to adaptive security system 170, adaptive security system 170 and MLF 210 perform actions in various combinations on UE 150, remote server 130 and/or management system 110. be able to. That is, machine learning is applied at each step of the method and can be performed by UE 150, remote server 130 and/or management system 110 in various combinations as described in more detail below.

MLF 210 may implement any number of suitable machine learning processes, algorithms or techniques, including anomaly detection, naive Bayesian classifiers, support vector machines, decision tree learning, neural network learning, reinforcement learning, and the like. The machine learning process may be tuned by design with machine learning parameters (eg, support vector machine kernel type, number of decision trees, etc.). MLF 210 can transform input values to determine patterns, correlations, features, statistics, predictions or classifications.

At step 604, adaptive security system 170 monitors user actions with UE 150 over time to establish a usage profile. At UE 150 , activity monitoring module 260 can monitor UE 150 and record device usage data 374 in memory 306 . For example, the UE 150 can identify user behavior (e.g., keystrokes, gestures, speech, movement, location, etc.), system behavior (e.g., notification alerts, application requests for system resources, processor interrupts, etc.), user 152 personal information (e.g., contact information, etc.). information, calendar information, etc.), content received from other sources (e.g., phone calls, downloads, website visits, etc.) and/or content stored in UE 150 (e.g., audio data captured from microphone 334, captured from camera 332). image data or video data) can be monitored and/or recorded.

Reporting module 365 is responsive to being triggered remotely by remote server 130 and/or management system 110 and/or in response to events detected in enterprise network environment 100. , may transmit device usage data 374 to remote server 130 and/or management system 110 at specified intervals. Usage history patterns associated with UE 150 may be detected by UE 150, remote server 130 and/or management system 110 . can be stored in

Additionally, UE 150 stores (eg, in memory 306) predefined and/or learned characteristics that trigger UE 150 to record data relating to the use of UE 150, or (eg, in management system 110). associated with them) within the device database. That is, pre-defined and/or learned characteristics may identify combinations of events, types of data, locations or specific points in time that may cause UE 150 to be misused to enable accurate monitoring of device usage data and/or or can be identified for the record. Exemplary triggers are the movement position or direction of UE 150 (eg, with respect to known or predicted locations obtained from calendar information or external data sources), the User 152's authorization to use particular data or functions, or User's 152 behavior over a period of time (e.g., with respect to exceeded thresholds that differ from behavioral patterns established during similar periods, times, etc.). Such trigger policy information may be provided to UE 150 by management system 110 and/or remote server 130 .

At step 606, adaptive security system 170 detects abnormal usage of UE 150 based on usage profile mismatch. Anomalous usage can be analyzed by MLF 210 of either UE 150, remote server 130 and/or management system 110 to detect anomalous usage. The analysis may be done in real-time or at a later point in time (e.g., after the UE 150 is back in range or reconnected to a compatible device/system, etc.) for a predefined length of time. time). As mentioned above, the MLF 210 can evolve/update over time without pre-defined instructions. Abnormal usage detection is thus specific to the UE 150 in relation to its device signature or usage profile associated with the UE 150 .

At step 608, adaptive security system 170 determines whether the abnormal use represents a security threat. Adaptive security system 170 can determine characteristics of cyber threats from the output of MLF 210 . That is, after training one or more MLFs 210 over time using abnormal usage information, the output machine learning results may, for example, classify cyber threat types and predict future cyber threat actions. or to determine that the threshold rate of change of the data correlates with a particular type of security vulnerability of the UE 150. In some embodiments, the output of MLF 210 can predict or reveal previously unconfirmed detailed data related to anomalous uses, such as tactics, techniques or procedures used by attackers. In addition, the MLF 210 outputs indicators or data resources left behind as a result of a cyber-attack, such as Internet Protocol (IP) addresses of servers used to orchestrate the attack or hashes or registry keys of files used in the attack. , can be identified or predicted.

At step 610, adaptive security system 170 instructs UE 150 to perform one or more automated actions to respond to the security threat. That is, threat response module 362 can select one or more actions to perform via output from MLF 210 . Alternatively or additionally, UE 150 may receive output from MLF 210 or instructions from remote server 130 and/or management system 110 as automatically executable instructions. Details of automatic actions will be described later.

7-10 are flowcharts illustrating methods for automatically responding to security threats in exemplary embodiments. The method is described with respect to the enterprise network environment 100 of FIG. However, those skilled in the art will recognize that the methods described herein may be performed by other devices or systems not shown. The steps of the method may be performed by one or more UEs 150, one or more remote servers 130, management system 110, or some combination thereof. The method steps described herein are not exhaustive and may include other steps not shown. These steps can also be performed in a different order.

FIG. 7 illustrates a method 700 for determining automated actions to take in response to security threats. The steps of method 700 may be performed as part of step 610 described above. At step 702, adaptive security system 170 classifies security threats. Classifications of security threats can trigger UE 150 to perform one or a series of actions as part of forensic action plan 704 , defensive action plan 706 and/or offensive action plan 708 . For example, the locus of a particular type of suspicious event for a particular device/user/worksite at a particular time of day may trigger a particular set of actions. Additionally, the actions determined by MLF 210 of adaptive security system 170 may be specific to a particular UE 150, its parameters, security settings, learned characteristics, and the like.

Forensic action plan 704 may include monitoring target resources of UE 150, such as specific applications, files, or hardware components, and/or authenticating UE 150 using predefined or learned characteristics. can be included. Defensive action plans 706 include hiding sensitive data or files, restricting application or user access or permissions, and gathering additional information on ongoing attacks to identify or identify attackers. It can include establishing an identification profile. Offensive action plans 708 include destroying sensitive data or files, providing false information or erroneous data sets in response to requests to access sensitive data in files, using hotspots to overwhelm wireless networks, Spoofing and mining data from devices within range, jamming radio and cellular signals, and attacks in progress (e.g. logging keystrokes, camera images/video, microphone audio, etc.) This can include limiting the performance or limiting the ability of UE 150 to be able to mine larger amounts of data.

FIG. 8 shows a method 800 for implementing an exemplary forensic action plan 704. As shown in FIG. At step 802, adaptive security system 170 detects that UE 150 has been compromised by a security threat. Management system 110 can detect that UE 150 has been compromised by a security threat, either through UE 150's own MLF 210 or in response to messages relayed from UE 150's MLF 210 and/or remote server . At step 804, adaptive security system 170 postpones disabling UE 150's access to enterprise network 102 for a period of time. At step 806, adaptive security system 170 instructs the user device to record security threat behavior. At step 808 , UE 150 reports security threat behavior to management system 110 . Thus, if UE 150 is compromised or stolen, management system 110 can use UE 150 to gather information about the attacker without excluding him from being part of the enterprise.

UE 150 can detect attacker behavior (e.g. keystrokes, gestures, speech, movement, location, etc.), system behavior (e.g., notification alerts, application requests for system resources, processor interrupts, etc.), personal information resources (e.g., contact information, calendar information, etc.), content received from other sources (e.g., phone calls, downloads, website visits, etc.) and/or content stored on the UE 150 (e.g., audio data captured from microphone 334, image data or video data) can be monitored and/or recorded. In one embodiment, adaptive security system 170 activates at least one of hardware components 330 (eg, microphone 334, camera 332, one of network components 340, etc.) and Instruct UE 150 to record security threat behavior by monitoring 330 . Management system 110 may receive and analyze security threat behavior and profile attack patterns for UEs 150 under its management, as discussed in further detail below.

FIG. 9 shows a method 900 for implementing an exemplary offensive action plan 706. As shown in FIG. At step 902, adaptive security system 170 detects that UE 150 has been compromised by a security threat. At step 904 , adaptive security system 170 identifies sensitive information accessible via UE 150 . For example, rules or policy information identifying sensitive information may be provided from management system 110 to UE 150 and stored in memory 306 of UE 150 as protected data 373 . At step 906, adaptive security system 170 identifies erroneous data sets provided by UE 150 based on security threat characteristics. For example, honeypot module 364 of UE 150 and/or disinformation module 414 of remote server 130 may interact with MLF 210 to generate, select and/or provide erroneous data 377 to memory 306 of UE 150 . Thereafter, in step 908, UE 150 provides erroneous data 377 in response to the request to access sensitive information.

FIG. 10 shows a method 1000 for implementing another exemplary offensive action plan 708 . At step 1002, adaptive security system 170 detects that UE 150 has been compromised by a security threat. At step 1004, adaptive security system 170 instructs UE 150 to activate hardware components to discover nearby devices. For example, MLF 210 may output instructions to UE 150 to activate WiFi 343 and disguise a wireless network using hotspots, or activate Bluetooth 341 to discover or connect to nearby devices. At step 1006, activity monitoring module 360/560 may monitor and record data related to message exchanges with hardware components to gather information of nearby devices. At step 1008, the UE 150 reports the collected proximity device information to the management system 110 (eg, a management server including the global device manager 520).

FIG. 11 is a flowchart illustrating a method 1100 for determining whether an anomaly indicates a security threat in an exemplary embodiment. At step 1102, adaptive security system 170 detects that UE 150 is involved in abnormal use. In one embodiment, detection of abnormal use may occur at UE 150 , a peer of UE 150 (eg, another user device managed by management system 110 ), remote server 130 , or management system 110 .

At step 1104 , adaptive security system 170 references the usage profile of UE 150 to identify peer UEs 150 associated with UE 150 . At step 1106 , adaptive security system 170 initiates an automatic communication exchange with other devices to confirm usage of UE 150 . For example, the remote server 130 or management system 110 issues a command to the user's laptop (or smart wearable, smart automotive system, etc.) to turn on its microphone, listen to the user's voice, and report the result of the confirmation. By doing so, the user of the mobile device can be authenticated. In doing so, remote server 130 or management system 110 may be associated with the same user established by the learned device usage and/or commonly connected to each other or within hearing range of speaker 333 , cameras The learned characteristics of a plurality of UEs 150, such as within the field of view 332 of , can be referenced (eg, as device usage data 374 in memory 306, in device database 522 of management system 110). The learned characteristics also provide timing information related to device proximity so that remote server 130 or management system 110 can issue timely commands via UE 150's peers to accurately ascertain the state of UE 150. can contain. Thus, UE 150 can cooperate with its peer UEs 150, remote server 130 and/or management system 110 to enable accurate detection and accurate response to security threats. Thereafter, at step 1108, adaptive security system 170 classifies the abnormal use to determine if it is a security threat. If so, remote server 130 or management system 110 can refer to device database 522 to identify characteristics that may inform action decisions in response to the security threat. If not a security threat, adaptive security system 170 can authorize use and use it as a training example for adapting MLF 210 and anomaly detection module 361/561.

FIG. 12 is a flow chart illustrating a method 1200 for deriving a graphical intrusion event sequence, in an exemplary embodiment. Interacts with MLF 210 to establish communication patterns received by (eg, edge device 108). In one embodiment, the activity monitoring module 360 of the edge device 108 can detect/provide patterns to the network traffic manager 530 . At step 1204 , adaptive security system 170 detects an intrusion event sequence within the communication pattern via MLF 210 . For example, the MLF 210 may analyze packet headers, frames, IP addresses, forwarding tables, or transmission routes (hop counts) between packets at servers of the enterprise network 102 to determine whether past activity (established as normal activity) is present. It can be determined whether it is different from the activity. At step 1206, adaptive security system 170 generates a graphical simulation of the intrusion event sequence. For example, the display module 563 can derive an intrusion event sequence for one or more UEs 150, filter the events by intrusion pattern, user, location, etc., and provide a step-by-step replay of the intrusion events to the GUI 508.

FIG. 13 is a flow chart 1300 illustrating a method for updating security policies of enterprise network environment 100 in an exemplary embodiment. At step 1302, adaptive security system 170 aggregates the patterns. Network traffic manager 530 can forward traffic patterns to traffic database 532 and global device manager 520 can forward device usage patterns to device database 522 . At step 1304, adaptive security system 170 builds an attacker profile based on the patterns. Adaptive security system 170 then updates the policy rules for enterprise network 102 at step 1306 . For example, if an attack is found to target a particular area of the corporate network 102, that particular area becomes a high priority checkpoint for more intensive/frequent monitoring by the activity monitoring module 560. be able to.

Further, the present disclosure includes embodiments according to the following clauses.
Clause 1: Monitor user interaction with a server configured to manage a plurality of user devices on a network and an interface component configured to communicate with the server on the network and user devices over time. to establish a usage profile, detect anomalous usage of the user device based on usage profile mismatches, determine whether the anomalous usage represents a security threat, and perform one or more automated actions A system comprising a user device comprising a processor implementing machine learning functionality configured to instruct the user device to respond to a security threat.
Clause 2: The server is configured to postpone disabling access to the network of the User Device for a period of time upon detecting that the User Device has been compromised by a security threat, and has a machine learning function is configured to instruct the user device to record the security threat behavior and report the security threat behavior to a server on the network during that period via the interface component.
Clause 3: The security threat behavior includes one or more of keystroke data, audio data, image data, application usage data or file access request data, and the server analyzes the security threat behavior to The system of Clause 2, configured to profile attack patterns directed at user devices above.
Clause 4: The system of Clause 2, wherein the machine learning functionality is configured to limit the ability of the user device to increase the amount of data collected regarding security threat behavior.
Clause 5: The machine learning function instructs the user device to activate at least one hardware component including one of a microphone, a camera and a network interface component, and monitors the at least one hardware component. The system of Clause 2, configured to record security threat behavior by:
Clause 6: The user device includes a radio interface component, and the machine learning function instructs the user device to activate the radio interface component to impersonate the wireless network, and the wireless device connecting to that wireless network. The system of Clause 1, configured to collect information and report the wireless device information to a server on the network.
Clause 7: A machine learning function identifies sensitive information stored in the memory of the user device that is susceptible to security threats, identifies erroneous data sets in the memory of the user device related to the sensitive information, The system of Clause 1, configured to provide an erroneous data set in response to a request to access information.
Clause 8: further comprising a remote server implementing a machine learning system configured to receive information about security threat behavior and to provide an erroneous data set to the user device based on security threat characteristics. 1 system.
Clause 9: Further comprising another user device managed by a server associated with the user device, and the machine learning function is transmitted to the other user device, wherein the authorized user uses the other user device 2. The system of Clause 1, configured to determine whether the abnormal use represents a security threat based on the verify proximity of the command.
Clause 10: The system of Clause 1, wherein the processor implements machine learning functionality in protected memory above the user device's operating system kernel or in one of the user device's hardware abstraction layers.
Clause 11: Communicate via the user device interface component with a server that manages multiple user devices on a network; implement machine learning capabilities with the processor of the user device; monitoring over time to establish a usage profile; detecting anomalous use of a user device based on usage profile discrepancies; determining whether the anomalous use represents a security threat; A method comprising instructing a user device to perform one or more automated actions obtained from a learning function to respond to a security threat.
Clause 12: In response to detection that the user device has been compromised by a security threat, postpone disabling the user device's access to the network for a period of time; 12. The method of clause 11, further comprising: instructing the user device to: and reporting security threat behavior to a server on the network via the interface component during the period.
Clause 13: further comprising analyzing security threat behavior to profile attack patterns directed at user devices on the network; 13. The method of clause 12, including one or more of data or file access request data.
Clause 14: One or more automated actions identify sensitive information stored in the memory of the user device that is susceptible to security threats; identify erroneous data sets associated with the sensitive information in the memory of the user device and providing an erroneous data set in response to a request for access to confidential information.
Clause 15: A non-transitory computer-readable medium embodying program instructions to be executed by a processor, the instructions being transmitted to the processor, via an interface component of the user device, over a network. Communicate with servers that manage devices; implement machine learning capabilities with user devices; monitor user interactions with user devices over time to establish usage profiles; and user device anomalies based on usage profile discrepancies detect the use; determine whether the abnormal use represents a security threat; and direct one or more automated actions derived from machine learning capabilities to respond to the security threat; computer readable medium.
Clause 16: The instructions cause the processor, in response to detecting that the user device has been compromised to a security threat, to delay, at the server, disabling the user device's access to the network for a period of time; 16. The computer-readable medium of clause 15, further instructing the user device to record the behavior of: and to report the security threat behavior to a server on the network during that period via the interface component.
Clause 17: The instructions further direct the processor to analyze security threat behavior to profile attack patterns directed at user devices on the network; 17. The computer-readable medium of Clause 16, comprising one or more of audio data, image data, application usage data or file access request data.
Clause 18: The instructions to the processor identify sensitive information stored in the memory of the user device that is susceptible to security threats; identify erroneous data sets associated with the sensitive information in the memory of the user device; 16. The computer-readable medium of clause 15, and further instructing to provide an erroneous data set in response to a request for access to confidential information.
Clause 19: The instructions identify to the processor another user device managed by the server associated with the user device; 16. The computer-readable medium of clause 15, further instructing to determine whether the abnormal use represents a security threat based on the confirm proximity to the device instruction.
Article 20: Detect abnormal use of the user device based on the history of use of the user device, input the abnormal use information into the machine learning function, determine the characteristics of the cyber threat from the output of the machine learning function, and determine the characteristics of the cyber threat and a processor configured to instruct the user device to perform the automatic action to respond to the cyber threat.
Clause 21: In response to determining that the cyberthreat profile includes a threat to access data of a certain type via the user device, the processor provides false information to respond to a request to access that type of data. 21. The apparatus of clause 20, configured to instruct a user device to provide.
Clause 22: The processor is configured to instruct the user device to erase data in response to determining that the cyber threat characteristics include a threat to information disclosure of data stored within the memory of the user device. Article 20 devices that are
Clause 23: The apparatus of Clause 20, wherein the processor implements machine learning functionality in a server remote from the user device.
Article 24: Detecting Abnormal Use of Devices Based on User Device Usage History; Inputting Abnormal Use Information into Machine Learning Functions; Determining Cyber Threat Characteristics from Machine Learning Function Outputs; Cyber Threats determining an automated action for the device to perform based on characteristics of the device; and instructing the device to perform the automated action to respond to the cyber threat.
Clause 25: Establishing communication patterns received by the device over the network interface by machine learning functions; detecting intrusion event sequences within the communication patterns by machine learning functions; and graphically simulating intrusion event sequences. 25. The method of clause 24, further comprising generating.

Any of the various control elements (eg, electrical or electronic components) shown or described herein may be implemented as hardware, processor-implemented software, processor-implemented firmware, or some combination thereof. For example, certain elements may be implemented as dedicated hardware. A dedicated hardware element may also be referred to as a "processor," "controller," or some similar terminology. If provided by a processor, the functionality may be provided by a single dedicated processor, by a single shared processor, or by multiple separate processors, some of which may be shared. Furthermore, any explicit use of the terms "processor" or "controller" should not be construed to refer only to hardware capable of executing software, including, but not limited to, digital signal processors (DSP ) hardware, network processors, application specific integrated circuits (ASICs) or other circuits, field programmable gate arrays (FPGAs), read only memory (ROM) for storing software, random access memory (RAM), non-volatile storage , logic or some other physical hardware component or module may be implicitly included.

A control element may also be implemented as processor or computer executable instructions to perform the function of that element. Some examples of instructions are software, program code, and firmware. Instructions are operational when executed by a processor to direct the processor to perform the functions of the component. The instructions may be stored in any storage device readable by a processor. Some examples of storage devices are digital or solid state memories, magnetic storage media such as magnetic disks and magnetic tapes, hard drives or optically readable digital data storage media.

Although specific embodiments are described herein, the scope of the disclosure is not limited to those specific embodiments. The scope of the disclosure is defined by the following claims and their equivalents.

Claims (10)

A system (100) comprising:
a server (108) configured to manage a plurality of user devices (150-1, 150-2, . . . , 150-N) on a network (102, 124);
A user device (150) comprising:
an interface component (202, 303, 402, 502) configured to communicate with said server on said network; and monitoring user interaction with said user device over time to establish a usage profile; detecting an abnormal use of the user device based on a mismatch of the user device, determining whether the abnormal use represents a security threat (128), and performing one or more automated actions to address the security threat (128); a processor (204, 302, 337) implementing a machine learning function (210) configured to instruct said user device to respond
and a system. upon detecting that the user device has been compromised by the security threat, the server is configured to postpone disabling access to the network for the user device for a period of time; and
The machine learning function instructs the user device to record the security threat behavior and to report the security threat behavior to the server on the network via the interface component during the time period. 2. The system of claim 1 , configured. the user device includes a wireless interface component (202); and
The machine learning function instructs the user device to activate the wireless interface component to impersonate a wireless network (124) to collect information of wireless devices (126) connecting to the wireless network; 3. The system of claim 1 or 2, configured to report said information of wireless devices to said server on said network. The machine learning function identifies sensitive information stored in a memory (206, 306, 338, 406, 506) of the user device susceptible to security threats, and identifies the sensitive information in the memory of the user device. and configured to provide said erroneous data set in response to a request for access to said confidential information. The system described in . a remote server (130) implementing a machine learning system configured to receive information about the behavior of the security threat and provide an erroneous data set (377) to the user device based on characteristics of the security threat; 5. The system of any one of claims 1-4, further comprising: a method,
Multiple user devices (150-1, 150-2, . communicating (1202) with a managing server (108);
implementing (602) machine learning functionality (210) in a processor (204, 302, 337) of said user device;
monitoring 604 user interactions with the user device over time to establish a usage profile;
detecting 606 abnormal usage of the user device based on the usage profile mismatch;
determining 608 whether the abnormal use represents a security threat; and performing one or more automated actions derived from the machine learning function to respond to the security threat. instructing (610) to
A method, including Postponing, at the server, disabling of the user device's access to the network for a period of time in response to detecting (802, 902, 1002, 1102) that the user device has been compromised by a security threat. (804);
instructing (806) the user device to record the behavior of the security threat; and reporting the behavior of the security threat to the server on the network via the interface component during the time period. (808)
7. The method of claim 6, further comprising: a device,
Detecting abnormal use of the user device (150) based on the history of use of the user device (150), inputting the information of the abnormal use into a machine learning function (210), and determining cyber threat characteristics from the output of the machine learning function. determine an automated action to be performed by the user device based on the characteristics of the cyber threat; and instruct the user device to perform the automated action to respond to the cyber threat. an apparatus comprising a processor (204, 302, 337) in which a False information for said processor to respond to a request to access said type of data in response to determining said characteristic of said cyber threat includes a threat to access said type of data via said user device. 9. The apparatus of claim 8, configured to instruct the user device to provide (414). In response to determining that the characteristics of the cyber threat include threats to information disclosure of data stored in memory (206, 306, 338, 406, 506) of the user device, the processor further comprises: 10. Apparatus according to claim 8 or 9, arranged to instruct the user device to erase data.

Images